Pop-ups on websites proclaiming that a PC is infected with a virus is a well-documented technique that sees users installing malicious software that masquerades as legitimate antivirus solutions, for example. Scams like these have been around for years. The abuse of ProtonVPN is only one of many vendors that have been used as a springboard to dupe users into downloading malicious software. That said, one essential thing to not do is to click on ads, especially when choosing products [ we install on our computers.” Brand awareness The Trojan collects system information and sends this data to a command and control (C2) server operated by the threat actors.īestuzhev told The Daily Swig: “This particular campaign runs on malicious banners from advertisement networks. Instead, the fake installer deploys AZORult. Victims who visit the counterfeit website download what they believe to be the legitimate installer for ProtonVPN. The wave of attacks on the ProtonVPN brand began in November 2019 with cybercriminals registering the domain protonvpnstore, Bestuzhev said. Kaspersky researcher Dmitry Bestuzhev said on Tuesday (February 18) that the AZORult Trojan, a data-stealer first discovered on underground Russian forums in 2016, is now at the center of a campaign abusing the reputation of ProtonVPN, a virtual private network service provider.

ProtonVPN is the latest vendor in a list of cybersecurity software providers that have had their names abused by threat actors in order to spread malware.

Cybercriminals have been sabotaging trusted brands for years

Vpn proton pc